245374 - Cannot overwrite remembered NTLM password with new password after changing it

Status: RESOLVED INCOMPLETE

(Toolkit :: Password Manager, defect)

Description

[Duncan Wright]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040206 Firefox/0.8
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040206 Firefox/0.8

Authenticating to an NTLM web server, Firefox prompts for username and password
correctly. If you save this password, and subsequently change your domain
password (ie if it's expired), you cannot change the password in Firefox.

If you enter the new password in the dialog and tick "remember this password",
the next time you open the page, Firefox has still got the old password.

Reproducible: Always
Steps to Reproduce:
1. Go to an NTLM authenticated page. Enter your domain password and tick "Use
password manager to remember this password"
2. Close Firefox.
3. Change your NT password
4. Go back to the authenticated page. Firefox (correctly) brings up your old
password. Overwrite the password with your new password
5. Close firefox, then go back to the page again. Firefox has failed to remember
your new password

Actual Results:  
Firefox continually recalls the old password

Expected Results:  
Overwrite the old password entry with the new one when you overtyped it and
ticked "Use password manager to remember this password"

 

Workaround: you can delete key3.db to work around this but obviously if you're
using password manager for other sites I guess it'll forget about them also.

In addition to all this, you can't view or delete the saved password in the
options dialog in password manager.

Comment 1

[Duncan Wright]

Addendum: OK, Firefox 0.9 does allow you to delete the password from tools |
Options. However it still doesn't overwrite when you enter a new password, so
the original bug stands.

Comment 2

[Joseph Shelby]

I have run into this extremely consistently in 0.7 through 0.9.1, both Windows
and Linux, and its rather annoying (as my work makes us change passwords
monthly) to have to keep re-entering it.

Its also annoying that if you make a mistake on the first entry, it remembers
the mistake and not any new entries of the right password until you delete the
entry in "Saved Passwords" under Options (which does work for me).

Comment 3

[Paul Lemke]

This probably is related to bug 253431 and bug 271235

Comment 4

[William Bumgarner [:zsinj]]

This bug was last touched before 1.0.4. Is it still reproducable?
Try the latest branch build (1.0.5): http://www.mozilla.org/products/firefox/
Try the latest nightly trunk build (v1.0+): http://www.mozilla.org/developer
(Reviving old UNCONFs)

Comment 5

[Paul Lemke]

Just tried it on the latest release, 1.0.5, and the bug is still there. Changed
NTLM pass, then relaunched browser, typed in new pass, it authenticated, closed
browser, opened it back up, and hit enter on the authentication box (because it
should have saved my pass) and it came back up because the pass was wrong. 

I'm at work so i'm not going to try a nightly build.

Comment 6

[Serge van Ginderachter]

I can confirm this bug persists in 1.5.0 Couldn't check 1.5.0.1, yet.

Comment 7

[Paul Lemke]

(In reply to comment #6)
> I can confirm this bug persists in 1.5.0 Couldn't check 1.5.0.1, yet.
> 

Still persits in 1.5.01

Comment 8

[David P James]

Mass edit: Changing QA to default QA Contact

Comment 9

[Jackie Liu]

Unfortunately, I don't have a NTLM server. ;)  Frankly, I'm not even quite sure what a NTLM server is.  But what you can do to help the progress of this bug is provide a NTLM server for me to test, if possible.  Thank you.

Comment 10

[Stephanie Daugherty [:sdaugherty]]

An NTLM server is usually IIS doing authentication against a Windows domain (or more commonly these days, an Active Directory domain)

Not a configuration you are likely to find outside the enterprise unfortunately.

Does this happen on trunk?

Comment 11

[Merlyel]

Confirming on   Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070430 Minefield/3.0a5pre ID:2007043004 [cairo]

After NTLM password change, fx shows password request dialog with old password. I change it to new password, fx accepts it and opens page. But there's still old password in password manager. And so upon closing and opening fx again it shows old password in request dialog.

BUT If after first password request (after NTLM password changing) I hit Enter (so fx tries to open sites with old NTLM password), fx shows one more password request dialog with empty login and password fields. So if I enter my login and new password now, fx saves them correctly (changes old password in password manager to the new one).

Comment 12

[Stephanie Daugherty [:sdaugherty]]

Confirming based on #11. This likely happens as well on older versions of Windows - 2000 is probably affected at the very least, however, I have no means to verify for those platforms, as I don't have IIS or an AD domain to authenticate against. 


 

Comment 13

[Justin Dolske [:Dolske]]

Can someone seeing this problem enable |signon.debug| and
|javascript.options.showInConsole| in about:config, reproduce to problem on a currently trunk nightly, and check for what's reported in the Error Console (under the Tools menu)?

Comment 14

[Justin Dolske [:Dolske]]

Can't proceed here without the information requested from comment 13.

The patch in bug 409146 will likely fix this, anyway.